CVE-2026-66472 is an unauthenticated SQL injection in Everest Backup, a WordPress backup plugin, scoring CVSS 9.3. That score reflects reality: the plugin has direct database access, handles full database dumps, and stores potentially sensitive credentials. An attacker with zero credentials, zero foothold, and zero chain-building can send a single malformed request and exfiltrate the entire database. The EPSS of 0.00291 does not contradict the CVSS score — it reflects current tooling maturity, not inherent risk. Historical patterns in utility and backup plugins show a two-to-three year lag between disclosure and automated weaponization, after which these vulnerabilities become standard enumeration targets in both criminal and red team toolchains. The low EPSS is a temporal snapshot, not a risk assessment.
The deeper issue is architectural, not attentional. Backup and utility plugins operate with database-adjacent privilege but are developed under the mental model of 'convenience tools.' This creates an implicit trust boundary that doesn't match actual privilege: developers assume upstream validation happens in the calling application, and that assumption becomes baked in and rarely revisited. When the endpoint is directly accessible — which it always is — the assumption breaks.
For defenders: first, treat every plugin function as receiving hostile input by default, regardless of what the calling application does. Second, audit your backup and utility plugins with the same rigor you'd apply to authentication modules — they have equivalent blast radius. Third, check plugin maintenance status; unmaintained plugins accumulate security debt as surrounding ecosystem changes (WordPress core updates, deprecated sanitization functions) invalidate whatever partial assumptions once held. If a backup plugin hasn't been updated in twelve months, treat it as a known high-risk dependency regardless of current CVEs.
The systemic fix requires structural pressure: plugin marketplaces should enforce minimum security assumptions about privilege contexts, flag abandoned plugins, and treat backup-adjacent code as implicitly high-privilege. Individual developer guidance won't break the inheritance chain of 'assume upstream validation' that recurs across decades of software history — from CGI scripts to SQL wrappers to API gateways to WordPress plugins. Make trust assumptions visible and auditable at the architecture level, not the individual cognition level.